kanidm/kanidm

Health v2 · maintenance only

Adoption not part of the score

5291 stars · 354 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Kanidm is a simple, secure, and fast identity management platform written in Rust that acts as a complete identity provider for other applications and services. It bundles OAuth2/OIDC SSO, WebAuthn passkeys, LDAP gateway, RADIUS, SSH key distribution, and Unix integration into a single self-hosted service.

Use cases

• self-host an SSO identity provider with OAuth2/OIDC
• replace Keycloak with a simpler identity management platform
• enable passkey/WebAuthn login for my applications
• manage Linux/Unix user accounts and SSH keys centrally
• provide RADIUS authentication for VPN and network access
• serve LDAP for legacy applications
• run identity management for a homelab or small business

When to choose

• you want a complete identity provider with OAuth2/OIDC built in, without needing Keycloak
• you want passkeys/WebAuthn and strict security defaults out of the box
• you need Linux/Unix integration, SSH key distribution, or RADIUS alongside SSO
• you find FreeIPA too heavy and complex but want more than a bare LDAP server

When to avoid

• you only need a minimal LDAP server and prefer something simpler like LLDAP
• you need deep LDAP customization or a generic directory server like OpenLDAP/389-ds
• you require Kerberos or a full FreeIPA feature set such as DNS and certificate authority

Facets

service · maturity active

auth authorization security self-hosted cli developer-tools security self-hosted developer-tools backend rust self-hosted identity-management oidc oauth2 webauthn passkeys ldap sso radius scim ssh-keys iam linux macos docker web-server

Member repositories

For agents

markdown · JSON · MCP: product_card(name="kanidm/kanidm")